Vmware, Inc.

Sandy Wilbourn

Derek L Bruening

Vladimir L Kiriansky

Saman P Amarasinghe

Bharath Chandramohan

Timothy Garnett

Srinivas Mantripragada

Tim Garnett

Charles Renert

Warren Wu

James Brink

A constraint is inserted into a program to address a vulnerability of the program to attacks. The constraint includes a segment of code that determines when the program has been asked to execute a 'corner case' which does not occur in normal operations. The constraint code can access a library of detector and remediator functions to detect various attacks and remediate against them. Optionally, the detector can be employed without the remediator for analysis. The context of the program can be saved and restored if necessary to continue operating after remediation is performed. The constraints can include descriptors, along with machine instructions or byte code, which indicate how the constraints are to be used.

Constraint injection system for immunizing software programs against vulnerabilities and attacks

Protected software, such as an application and/or DLL, is monitored by protective software to guard against attacks, while distinguishing spurious, benign events from attacks. In a 1-touch approach, the protected software is monitored in a testing environment to detect spurious, benign events caused by, e.g., incompatibility or interoperability problems. The spurious events can be remediated in different ways, such as by applying a relaxed security policy. In a production mode, or 0-touch mode, when the protected software is subject to attacks, the corresponding remediation can be applied when the spurious events are again detected. Security events which occur in production mode can also be treated as benign when they occur within a specified time window. The applications and/or DLLs can further be classified according to whether they are known to have bad properties, known to be well-behaved, or unknown. Appropriate treatment is provided based on the classification.

0-touch and 1-touch techniques for improving the availability of computer programs under protection without compromising security

Growing community of inventors

Palo Alto, CA, United States of America

Sandy Wilbourn