Apple Inc.

Pure Storage, Inc.

Jonathan McLachlan

Julien Lerouge

Daniel F Reynaud

Augustin J Farrugia

Nicholas Thomas Sullivan

Mathieu Ciet

Gianpaolo Fasoli

Thomas Icart

Benoit Chevallier-Mames

David M'Raihi

Pierre Betouin

Yu Tan

Cédric Tessier

Li Zhao

Jean-Baptiste Aviat

Sitaraman Suthamali Lakshminarayanan

Christopher Holtz

An exemplary access control system controls access to a computing system such as a data storage system. For example, the exemplary access control system includes a remote management system that receives a request to operate on an element of the computing system and generates a message based on the request and a first token for the remote management system that is associated with the request. The message includes data representative of a second token for the remote management system. The remote management system signs the message and transmits the signed message to the computing system, which is configured to verify and use the signed message, including the second token included in the signed message, to obtain and use a local access token to access and operate on the element in accordance with the request.

Access control for a computing system

An authentication challenge system for performing secondary authentication for an account associated with an online store is described. In one embodiment, the authentication challenge system includes a question generation engine, which can derive a series of questions based upon activity associated with a user account of an online store; a network interface, which can transport the series of one or more questions derived by the question generation engine to authenticate the user to the online store; a confidence engine, which can determine a required confidence level for a successful authentication, and can compute a confidence score of the user identity; and a quality engine, which can adjust the question generation engine and the confidence engine based upon an analysis of question and answer metrics across multiple accounts of the online store. The online store can include digital media, such as music, movies, books or applications for electronic computing devices.

Adaptive secondary authentication criteria based on account data

Methods, media and systems that use an encoded opaque pointer in an API between a client process and a library process. An encoded opaque pointer, in one embodiment, can be received by the library process from the client process, and the library process can decode the opaque pointer to obtain an address in memory containing a data structure pointed to by the opaque pointer. The library process can operate on the data structure to create a revised or processed data structure, stored in the same or different address in heap memory or stack memory, and the library process can encode and return a new opaque pointer, for the processed data structure, to the client process.

Data protection for opaque data structures

A method and an apparatus that provide rewriting code to dynamically mask program data statically embedded in a first code are described. The program data can be used in multiple instructions in the first code. A code location (e.g. an optimal code location) in the first code can be determined for injecting the rewriting code. The code location may be included in two or more execution paths of first code. Each execution path can have at least one of the instructions using the program data. A second code may be generated based on the first code inserted with the rewriting code at the optimal code location. The second code can include instructions using the program data dynamically masked by the rewriting code. When executed by a processor, the first code and the second code can generate identical results.

Method and apparatus for dynamic obfuscation of static data

Techniques, methods, systems, and computer-readable media for allocating and managing dynamically obfuscated heap memory allocations are described. In one embodiment a memory manager in a data processing system contains an addressor, to determine a first address of a program object in a first memory address space, and one or more encoders, to abstract memory access to the program object using the first address such that layout of the object data in the first address space differs from the layout of the object in a second address space. In one embodiment, a runtime system modifies object code of an executable file to include encoder routines to abstract memory accesses to data in an obfuscated heap. In one embodiment, a compiler system using an intermediate representation of a high level program generates an intermediate representation of a high level program capable of performing memory writes and memory reads using obfuscation encoder routines.

Dynamic obfuscation of heap memory allocations

In one embodiment, a system wide static global stack pool in a contiguous range of random access memory is generated, a block of memory in the system global pool is assigned to a thread of a running process, and the thread stores local variable information in static global stack pool, such that the local variable is hidden from a stack frame back-trace. In one embodiment, a dynamically allocated data structure in system heap memory is generated, the data structure is locked to ensure atomic access, a block of memory in the data structure is assigned to a thread of a process, the data structure is unlocked, and the thread stores local variable information in static global stack pool, such that the local variable is hidden from a stack frame back-trace.

Obfuscating function resources while reducing stack consumption

A branch auditing system can be automatically injected into a computer program, in one embodiment, in response to a programming call provided in source code by a programmer who has selected a particular branch, in a set of possible branches, for auditing. The branch auditing system can record, in an obfuscated data structure, a path taken at the particular branch and the parameters associated with the branch and later an auditor can determine whether the path taken was valid, and if the path taken was invalid, operations can be performed to protect the program, system and/or user.

Branch auditing in a computer program

Methods, media and systems that obfuscate control flow in software programs. The obfuscation can impede or prevent static flow analysis of a software program's control flow. In one embodiment, a method, performed by a data processing system, identifies each branch point in a set of branch points in a first version of software and replaces, in each branch point in the set, a representation of a target of the branch point with a computed value that depends upon at least one prior computed value in a stream of instructions in the first version of software. Other embodiments are also described.

Growing community of inventors

San Francisco, CA, United States of America

Jonathan McLachlan