Trend Micro Inc.

Narasimham Kodukula

Bharath Kumar Chandra Sekhar

Bharath Kumar Chandrasekhar

Shuosen Robert Liu

Jianda Li

Andrew John Dancer

Apparatus and methods for controlling access by a browser to one or more Internet servers are disclosed. Access control is performed by ascertaining an IP address of an internet server that the user is trying to access and performing lookup of the IP address in an IP address rating database. If the lookup reveals that the IP address to be suspicious and data received from the internet server is encrypted, block the access to the internet server. Alternatively, if the lookup reveals the IP address to be suspicious, block the access to the first internet server by the browser without first performing content analysis on the data from the internet server.

Methods and apparatus for controlling internet access

Virtual machine images in a cloud computing environment may be certified using a validator machine image. The validator machine image is configured to boot a validator virtual machine, which boots a virtual machine off a virtual machine image from among virtual machine images available in the catalog of the cloud computing environment. The validator virtual machine may scan the virtual machine for malware, including computer viruses. A virtual machine image from among the virtual machine images may be packaged to include a certifier agent that verifies the virtual machine image upon execution. Reputation of virtual machine images may be stored in a virtual machine image reputation database and made available by way of a portal.

Certification of virtual machine images in cloud computing environments

Computer implemented methods and apparatuses for detecting and/or blocking anonymized data even if the user employs a web server that is not known to the web filter to be an anonymizing web server (such as a user-hosted anonymizer). The anonymize attempt may be detected by monitoring for the HTTPMoved message and parsing the HTTPMoved message for URLs, which may then be checked for unapproved content. The anonymize attempt may, additionally or alternatively, be detected by looking the IP addresses in an IP address rating database to detect suspicious traffic.

Detecting anonymized data traffic

Disclosed is a technique for pre-emptive URL filtering. A filtering engine may be configured to receive an original set of URLs from a web server along with a main content, the original set of URLs and the main content being intended for a web browser running in a client computer. The filtering engine may be running in a gateway. The filtering engine may check the original set of URLs for blocked URLs. The filtering engine may create a reconstructed set of URLs that suppresses blocked URLs in the original set of URLs. The filtering engine may send the client computer the reconstructed, instead of the original, set of URLs. This advantageously cuts down on the number of HTTP connections that have to be made by the browser, and corresponding URL filtering at the gateway, in situations where there is a blocked URL in the original URL set.

Pre-emptive URL filtering technique

A cloud computing environment includes a key management server and a cloud computer system running several virtual machines. A virtual machine hosted by the cloud computer system includes an integrity check module for checking the integrity of the virtual machine and getting identity information of the virtual machine. The integrity check module sends a key request to a key management server, which provides key service to different cloud computer systems. The key management server validates the request and, if the request is valid, provides the key to the virtual machine. The key is used to unlock an encrypted file system in the virtual machine.

Protection of customer data in cloud virtual machines using a central management server

Cache storage area for caching data for URL filtering is reserved for each user in a multi-user computing environment. The cache storage area may include a user-specific cache with user cache areas allocated for each particular user. The user cache areas may include entries for data pertaining to URL filtering. For example, the entries may include URL filtering results or references to URL filtering results stored in a general cache. Cache data may include a reference count to indicate the number of users for which the data is being cached. The reference count may be taken into account in the maintenance of the general and user-specific cache areas.

User-specific cache for URL filtering

Method and system for performing content filtering services in a computer network. A gateway computer may be configured to be in the data path of network communications between client computers in a private computer network and computers in a public computer network. A master entity in the gateway computer may be configured to determine content filtering services available in the client computers. The master entity may delegate to the client computers performance of content filtering services that may be reliably performed in the client computers. Each of the client computers may include a trusted agent in communication with the master entity to coordinate content filtering in the private computer network.

Delegation of content filtering services between a gateway and trusted clients in a computer network

A method for providing reputation information concerning a domain is disclosed. The domain may include one or more devices on a network. The method may include retrieving a first reputation pertaining to a first function of the domain. The method may also include generating a message containing information pertaining to the first reputation and at least a second reputation, wherein the second reputation pertains to a second function of the domain.

Apparatus and methods for reputation-based filtering on a communication network

In one embodiment, a router inspects at a network layer source addresses of network layer packets flowing through the router. The router compares the source addresses to addresses of computers employed by spammers, and performs a predetermined action on a particular network layer packet having a source address that belongs to a computer of a spammer. The predetermined action may involve dropping the particular network layer packet or limiting the data transfer rate of the particular network layer packet.

Growing community of inventors

Sunnyvale, CA, United States of America

Narasimham Kodukula