会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 2. 发明申请
    • Portion-level in-memory module authentication
    • 部分级内存模块认证
    • US20060026569A1
    • 2006-02-02
    • US10902244
    • 2004-07-29
    • Timothy OertingPhilip LafornaraRobert OliverScott BrenderMichael Marr
    • Timothy OertingPhilip LafornaraRobert OliverScott BrenderMichael Marr
    • G06F9/44
    • G06F21/51
    • Dynamic run-time verification of a module which is loaded in memory (in whole or in part) for execution is enabled by using pre-computed portion-level verification data for portions of the module smaller than the whole (e.g. at the page-level). A portion of the module as loaded into memory for execution can be verified. Pre-computed portion-level verification data is retrieved from storage and used to verify the loaded portions of the executable. Verification data may be, for example, a digitally signed hash of the portion. Where the operating system loader has modified the portion for execution, the modifications are reversed, removing any changes performed by the operating system. If the portion has not been tampered, this will return the portion to its original pre-loaded state. This version is then used to determine validity using the pre-computed portion-level verification. Additionally, during execution of the module, new portions/pages of the module which are loaded can be verified to ensure that they have not been changed, and a list of hot pages of the module can be made, including pages to be continually reverified, in order to ensure that no malicious changes have been made in the module.
    • 通过对小于整个模块的部分(例如在页面级别)使用预先计算的部分级验证数据来启用加载在存储器(整体或部分)中用于执行的模块的动态运行时验证 )。 可以验证加载到存储器中用于执行的模块的一部分。 从存储器检索预先计算的部分级验证数据,并用于验证可执行文件的加载部分。 验证数据可以是例如该部分的经数字签名的散​​列。 在操作系统加载程序修改了执行部分的情况下,修改将相反,从而删除操作系统执行的任何更改。 如果该部分没有被篡改,这将使该部分恢复到原来的预加载状态。 然后使用该版本使用预先计算的部分级验证来确定有效性。 此外,在执行模块期间,可以验证装载的模块的新部分/页面,以确保它们未被更改,并且可以制作模块的热页面列表,包括要不断重新验证的页面, 以确保模块中不会发生恶意更改。
    • 3. 发明申请
    • Run-time call stack verification
    • 运行时调用堆栈验证
    • US20050198645A1
    • 2005-09-08
    • US10790302
    • 2004-03-01
    • Michael MarrScott Brender
    • Michael MarrScott Brender
    • G06F3/00
    • G06F21/606G06F21/10
    • Run-time call stack verification is used to determine that a code module has been called by a legitimate caller. A return address on the stack indicates where execution is to return upon execution of the next return instruction, and this return address is indicative of where the code module was called from. The code module may determine that the call is allowed, or disallowed, based on the location of the return address. A calling convention is provided that allows the code module to be called through an intermediary, while also preserving the original return address that was in effect at the time the intermediary was called and also resisting modification to the call stack during the time that the original return address is being verified.
    • 运行时调用堆栈验证用于确定代码模块已由合法调用者调用。 堆栈上的返回地址指示在执行下一个返回指令时执行的返回地址,此返回地址表示代码模块从哪里被调用。 代码模块可以基于返回地址的位置来确定允许或不允许该呼叫。 提供了一种调用约定,允许代码模块通过中介进行调用,同时还保留在中间件被调用时有效的原始返回地址,并且还可以在原始返回的时间内抵制对调用堆栈的修改 地址正在验证。
    • 4. 发明申请
    • Import address table verification
    • 导入地址表验证
    • US20050198507A1
    • 2005-09-08
    • US10794292
    • 2004-03-05
    • Scott BrenderPhilip LafornaraMichael MarrRobert Oliver
    • Scott BrenderPhilip LafornaraMichael MarrRobert Oliver
    • H04L9/00
    • G06F12/1416G06F21/51
    • The import address table of a software module is verified in order to prevent detouring attacks. A determination is made regarding which entries in the IAT must be verified; all of the entries may be verified or some subset of the entries that are critical may be verified. For each external function, the external module containing the external function is loaded, if it is not already loaded. The function address in the exported function table is found. That address is compared to the address for the function in the IAT. Additionally, the external module, in one embodiment, is verified to ensure that it has not been modified. For a delay load IAT, a similar procedure is followed; however the delay load IAT may be periodically checked to ensure that the delay load IAT entries are either valid (indicating that the external function has been bound) or in their initial state (indicating that no binding has yet occurred).
    • 验证软件模块的导入地址表,以防止迂回攻击。 确定必须验证IAT中的哪些条目; 可以验证所有条目,或者可以验证关键的条目的某些子集。 对于每个外部功能,如果外部模块尚未加载,则会加载包含外部功能的外部模块。 找到导出的功能表中的功能地址。 该地址与IAT中功能的地址进行比较。 此外,在一个实施例中,外部模块被验证以确保其未被修改。 对于延迟负载IAT,遵循类似的过程; 然而,可以定期检查延迟负载IAT以确保延迟负载IAT条目是有效的(指示外部功能已经被绑定)或处于其初始状态(指示还没有发生绑定)。
    • 9. 发明申请
    • Rollover solutions
    • 翻转解决方案
    • US20060293984A1
    • 2006-12-28
    • US11167812
    • 2005-06-27
    • Tom LochWilker BruceMichael Marr
    • Tom LochWilker BruceMichael Marr
    • G06Q40/00
    • G06Q40/00
    • An apparatus for and a method of an electronic middleware interface consisting of communication interfaces designed to transfer data between financial record keeping systems and new account opening applications is presented. A retirement savings plan (RSP) administrator computer server communicates via the electronic middleware communication interfaces to a Rollover Solutions Network (RSN) application computer server to communicate financial savings plan participant data. The RSN application computer server utilizes the participant data to contact a financial service provider (FSP) computer server to identify the participant retirement accounts for rollover purposes. Alternatively, the RSN application computer server can contact the FSP computer server to open a new retirement account. Utilizing either the established retirement account or the new retirement account the RSN application computer server instructs the RSP administrator computer server to initiate rollover of the participants retirement account funds to the FSP.
    • 提出了一种电子中间件接口的装​​置和方法,其由设计成在财务记录保存系统和新开户应用之间传送数据的通信接口组成。 退休储蓄计划(RSP)管理员计算机服务器通过电子中间件通信接口与滚动解决方案网络(RSN)应用计算机服务器进行通信,以传达财务储蓄计划参与者数据。 RSN应用程序计算机服务器利用参与者数据联系金融服务提供商(FSP)计算机服务器以识别参与者退休账户以进行翻转。 或者,RSN应用计算机服务器可以联系FSP计算机服务器以打开新的退休账户。 利用既定的退休账户或新的退休账户,RSN应用计算机服务器指示RSP管理员计算机服务器启动参与者退休账户资金向FSP的转帐。
    • 10. 发明申请
    • Disposable red partitions
    • 一次性红色分区
    • US20060248587A1
    • 2006-11-02
    • US11118062
    • 2005-04-29
    • Kenneth RayPaul EnglandNathan LewisMichael Marr
    • Kenneth RayPaul EnglandNathan LewisMichael Marr
    • G06F12/14
    • G06F21/575G06F21/57
    • A system and method are provided, whereby data that is easily re-created is separated from data that is not easily re-created, such that the easily re-created data can be disposed of based on a variety of events and the not easily re-created data can be kept in its original state. In one aspect of the invention, such easily re-created data is disposed of based on a “panic button” being pushed by a computer system user, such as when a user becomes aware that some malware has infected the computer system. In other aspects of the invention, such data is disposed of every time the computer system boots up, or detects via its anti-virus program that some malware is present. In other aspects of the invention, the easily re-created data can be rolled back or rolled forward without affecting the non-easily re-created data.
    • 提供了一种系统和方法,由此容易重新创建的数据与不容易重新创建的数据分离,使得可以基于各种事件来处理容易重新创建的数据,并且不容易地重新生成 处理的数据可以保持原来的状态。 在本发明的一个方面中,基于由计算机系统用户推送的“紧急按钮”(例如当用户意识到某些恶意软件已经感染了计算机系统时)来处理这样容易重新创建的数据。 在本发明的其他方面,每当计算机系统启动时处理这样的数据,或者通过其防病毒程序来检测存在一些恶意软件。 在本发明的其它方面,容易重新创建的数据可以回滚或滚动,而不影响不容易重新创建的数据。