Se Cure 64 Software Corporation

Hewlett-packard Development Company, L.p.

William S Worley, Jr

Chris Deon Hyser

John S Worley

Boris Balacheff

Graeme John Proudler

Bret Alan McKee

Robert David Gardner

Daniel J Magenheimer

Thomas W Christian

Matthew Harbridge Gerlach

Christopher Scott Worley

James Garnett

Christopher Worley

Embodiments of the present invention include a variety of different integrated, multi-tiered methods and systems for preventing various types of attacks on computer systems, including denial-of-service attacks and SYN-flood attacks. Components of these integrated methods and systems include probabilistic packet droppers, packet-rate throttles, resource controls, automated firewalls, and efficient connection-state-information storage in memory resources and connection-state-information distribution in order to prevent draining of sufficient communications-related resources within a computer system to seriously degrade or disable electronics communications components within the computer system.

Method and system for protecting a computer system from denial-of-service attacks and other deleterious resource-draining phenomena related to communications

In various embodiments of the present invention, execution-state transitions occur in a first portion of a system, and a cumulative execution state for each process is maintained by a second portion of the system so that, when a second-portion routine is called, the second-portion routine can determine whether or not the current execution state is suitable for execution of the second-portion routine. In various embodiments, a callpoint log, allocated and maintained for each process, stores the cumulative execution state for the process. In one embodiment, the first portion is an operating system, and the second portion is a secure kernel, with the cumulative execution state used by the secure kernel to prevent unauthorized access by erroneously or maliciously invoked operating-system routines to secure kernel routines. In another embodiment, the cumulative execution state is used as a debugging tool by the second-portion routines to catch errors in the implementation of the first-portion routines.

Method and apparatus for system caller authentication

Methods and techniques for implementing a custom execution environment (CE) and a related loader are provided. According to one embodiment, the CEincludes code and data sections of an application and code and data sections of a set of system services. The set of system services has direct and full control of a set of hardware resources of a computer system containing one or more processors implementing a parallel protected architecture. According to one embodiment, the system services are designed for maximum simplicity, fastest possible speed, and elimination of security vulnerabilities.

Customized execution environment

Operating system methods and techniques for supporting one or more custom execution environments (CEs) are provided. According to one embodiment, a determination is made with respect to which system resources of a computer system, if any, are to remain under control of a resident operating system of the computer system and which of the system resources are to be placed under control of one or more CEs. The system resources are then partitioned among the resident operating system and the one or more CEs by associating one or more partitions of the system resources with the one or more CEs. Such partitioning may be performed by the resident operating system by employing hardware-based isolation techniques provided by a processor of the computer system, performed by the resident operating system by employing a secure-platform interface, or configured by a system administrator via hardware partitioning capability provided by the computer system platform.

Operating system capable of supporting a customized execution environment

A computer apparatus for creating a trusted environment comprising a trusted device arranged to acquire a first integrity metric to allow determination as to whether the computer apparatus is operating in a trusted manner; a processor arranged to allow execution of a first trust routine and associated first operating environment, and means for restricting the first operating environment access to resources available to the trust routine, wherein the trust routine being arranged to acquire the first integrity metric and a second integrity metric to allow determination as to whether the first operating environment is operating in a trusted manner.

Apparatus and method for creating a trusted environment

Growing community of inventors

Centennial, CO, United States of America

William S Worley, Jr