US20080201777A1 - Method and Agent for the Protection Against the Unauthorized Use of Computer Resources - Google Patents
Method and Agent for the Protection Against the Unauthorized Use of Computer Resources Download PDFInfo
- Publication number
- US20080201777A1 US20080201777A1 US12/111,678 US11167808A US2008201777A1 US 20080201777 A1 US20080201777 A1 US 20080201777A1 US 11167808 A US11167808 A US 11167808A US 2008201777 A1 US2008201777 A1 US 2008201777A1
- Authority
- US
- United States
- Prior art keywords
- workstation
- request
- access
- application
- computer resource
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6281—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database at program execution time, where the protection is within the operating system
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
- Computer And Data Communications (AREA)
Abstract
Method and agent for preventing a hostile use of computer resources by an application running on a workstation. A list of services that are not allowed for access by unspecified applications is provided, and when such unspecified application runs on the workstation, the application is prevented from accessing any resource directly. Any direct or indirect request for access to specific services is analyzed, to determine whether such request is allowable according to the list. The workstation processes the request if it is allowable. The unspecified application is prevented from accessing the requested resource if the request is not allowable. The resource may be any local or remote resource, such as, memory allocation, files, directories, operations with files and directories, such as copy, delete or compress, or any other operation leading to a permanent change in the workstation or its periphery.
Description
- This application is a divisional of U.S. patent application Ser. No. 09/622,959 filed Feb. 25, 1999, entitled Method and Agent for the Protection Against the Unauthorized Use of Computer Resources which claims priority to PCT/IL99/00113 filed Feb. 25, 1999 which claims priority to Israel Application 123512 filed Mar. 2, 1998.
- The present invention relates to the security management of computers. More particularly, the invention relates to a method and an agent for preventing the access to the use of computer resources by hostile applications.
- The Internet has developed very much both in respect of its contents and of the technology employed, since it began a few years ago. In the early days of the Internet, web sites included text only, and after a while graphics was introduced. As the Internet developed, many compressed standards, such as pictures, voice and video files, were developed and with them programs used to play them (called “players”). Initially, such files were downloaded to the user's workstation only upon his request, and extracted only by the appropriate player, and after a specific order from the user.
- When, in the natural course of the development of the World Wide Web the search for a way to show nicer, interactive and animated Web Pages began, Sun Microsystems Inc. developed Java—a language that allows the webmaster to write a program, a list of commands—Network Executables—that will be downloaded to the user workstation most of the time without his knowledge, and executed by his browser at his workstation. The executables are used, e.g., to provide photographic animation and other graphics on the screen of the web surfer. Such executables have ways of approaching the user workstation's resources, which lead to a great security problem. Although some levels of security were defined in the Java language, it was very soon that a huge security hole was found in the language.
- Since Java was developed, Microsoft developed ActiveX, which is another Network Executable format, also downloaded into the workstation. ActiveX has also security problems of the same kind.
- The Internet has been flooded with “Network Executables” which may be downloaded—deliberately or without the knowledge of the users—into workstations within organizations. These codes generally contain harmless functions. Although usually safe, they may not meet the required security policy of the organization.
- Once executed, codes may jam the network, cause considerable irreversible damage to the local database, workstations and servers, or result in unauthorized retrieval of information from the servers/workstations. Such elements may appear on Java applets, ActiveX components, DLLs and other object codes, and their use is increasing at an unparalleled pace. The majority of these small programs are downloaded into the organization unsolicited and uncontrolled. The enterprise has no way of knowing about their existence or execution and there is no system in place for early detection and prevention of the codes from being executed.
- The problem is made worse, in some cases, by the existence of large intranets and LANs, which may also be used by unauthorized persons to access workstations and perform hostile activities thereon.
- The security problem was solved partially by the browser manufactures which allow the user to disable the use of executables. Of course this is not a reasonable solution, since all the electronic commerce and advertising are based on the use of executables.
- In three copending patent applications of the same applicants hereof, IL 120420, filed Mar. 10, 1997, IL 121815, filed Sep. 22, 1997, and IL 122314, filed Nov. 27, 1997, the descriptions of which are incorporated herein by reference, there are described methods and means for preventing undesirable Executable Objects from infiltrating the LAN/WAN in which we work and, ultimately, our workstation and server. IL 122314 further provides a method for enforcing a security policy for selectively preventing the downloading and execution of undesired Executable Objects in an individual workstation.
- While much has been done in the abovementioned patent applications toward protecting the individual workstation, one problem yet remained unsolved: the hostile use of local resources by applications which have passed any earlier security check (e.g., a gateway security policy), because they did not contravene such security policy, or by applications which have not passed through an earlier check point (such as a gateway equipped with a security policy check, as described in the aforementioned Israeli patent applications), either because such earlier point of check is not available, or because the application has been loaded directly on the workstation. Such hostile use of CPU resources may lead to damage to the data, operation and hardware of the workstation and, under the conditions contemplated above, may go undetected until the damage is done.
- It is an object of the present invention to provide a method and agent which overcomes the aforesaid drawbacks of prior art methods, and which provides effective protection at the workstation level.
- It is another object of the present invention to provide a method and an agent which can be used effectively to prevent the hostile use of workstation resources by applications running on said workstation.
- Other objects and advantages of the invention will become apparent as the description proceeds.
- In one aspect, the invention is directed to a method for preventing an hostile use of computer resources by an application running on a workstation, comprising the steps of:
-
- a) providing a list of services that are not allowed for access by unspecified applications;
- b) when such unspecified application runs on the workstation, preventing said application from accessing any resource directly;
- c) analyzing any direct or indirect request for access to specific services, to determine whether such request is allowable according to the list defined under a) above;
- d) if the request is allowable, allowing the workstation to process it; and
- e) if the request is not allowable, preventing the unspecified application from accessing the requested resource;
wherein said resource may be any local or remote resource, including, but not limited to, memory allocation, files, directories, operations with files and directories, such as copy, delete or compress, or any other operation leading to a change in the workstation or its periphery. Illustrative—but not limitative—examples of such operations include access to system files, configuration information, network communications, hardware equipment (floppy, modem, etc.), CMOS data (time, date, etc.), or the use of resources such as memory allocation, process creation, threads creation, use of excessive CPU time, use of excessive disk space, use of excessive network communication, and use of excessive graphical resources and use of system or application configuration.
- According to a preferred embodiment of the invention the list of services is provided as a look-up table.
- By “unspecified application” it is meant to indicate an application that is not specifically identified in a pre-set list of applications. According to a preferred embodiment of the invention, said pre-set list of applications includes a list of resources which each application may utilize.
- In another aspect, the invention is directed to an agent for protecting a workstation against the hostile use of computer resources by an unspecified application running on said workstation, comprising:
-
- a) means for detecting an unspecified application or a module of an application running on the workstation;
- b) means for determining the requests for resources to be used by said unspecified application;
- c) means for identifying chain requests for resources utilization, wherein said chain requests comprise requests made by resources called by said unspecified application;
- d) means for determining whether requests made directly by said unspecified application are allowable;
- e) means for determining whether requests made indirectly, as chain requests, by said unspecified application would be not allowable if made directly by said unspecified application; and
- f) means for preventing said chain request from being processed, if it is determined that the request is not allowable, or that it would not be allowable if made directly by said unspecified application, and for allowing its processing if otherwise determined.
- According to a preferred embodiment of the invention, the means for determining whether requests made directly or indirectly by said unspecified application are allowable comprise a look-up table including a list of services that are not allowed for access by unspecified applications. In another preferred embodiment of the invention, the agent comprises a pre-set list of applications including a list of resources that each application may utilize.
- All the above and many other characteristics and advantages of the invention, will be better understood through the following illustrative and non-limitative examples of preferred embodiments thereof, with reference to the appended drawings.
-
FIG. 1 schematically illustrates different applications and their requests and related operations; -
FIG. 2 schematically illustrates a detail of an illustrative application that will cause machine malfunctioning; and -
FIG. 3 illustrates a situation in which indirect unallowable resource exploitation is attempted. - Examples of such situations are exemplified in
FIGS. 1-3 . Referring toFIG. 1 , three different applications are shown, marked APP1 through APP3. The process takes place at three different levels: the user mode (indicated by “U.M.”), the kernel mode (indicated by “K.M.”), and the hardware (indicated by “H.W.”). The three different modes are schematically separated in the figure by straight lines. The APP1, APP2 and APP3 applications operate in the user mode. APP1 is an “open file” I/O request. This request is passed on to the I/O manager, which, in turn, refers to the disk(s) to perform the required operation. A filter (indicated as “S7 Filter” in the figure) analyzes the request to determine whether it is permissible according to the security policy. If it is permissible, it is allowed to proceed to the I/O manager, which processes the request with the disk(s). - APP2, on the other hand, makes a request involving the network, i.e., and “open connection to the file server” request. The network manager is allowed to process this request only if the filter S7 has determined that it is permissible. Similarly, APP3 makes a memory allocation request, which is examined by the filter and, if permissible, is passed on to the memory manager and then acted upon in connection with the memory.
- The operation of the various requests in the kernel mode and vis-a-vis the hardware, after the filter has examined and allowed them, is the same as with conventional operations in everyday computer, is well known to the skilled person, and therefore is not described herein in detail, for the sake of brevity.
- Looking now at
FIG. 2 , a detail of an illustrative application that will cause machine malfunctioning is shown. In this example APP 1 generates 1000 requests to generate new processes. If the system of the invention is not present, the 1000 requests will be passed on to the CPU by the Process Manager, and will use all the resources of the CPU, thus holding the work of the machine. If the filter of the invention is present, however, it may be pre-set to allow the generation of only a limited number of processes by the same application. Therefore, if a number of new processes are requested by a single application, which exceeds the preset limit, the filter S7 will not allow it to pass on to the process manager, thus avoiding the exhaustion of the resources of the machine. -
FIG. 3 illustrates a situation in which indirect unallowable resources exploitation is attempted. In this example APP 1 is of a type that is not allowed to send a request to the I/O Manager. If it attempts to do so, it is stopped by the S7 Filter, unless the request complies with the Security Policy preset with S7. APP1 may therefore be programmed so as to effect an interprocess communication, viz., to communicate its request to a further process, APPX, which is permitted to make the request that APP1 is not allowed to make, to the I/O/ Manager. In this case, the S7 filter between the User Mode and the Kernel Mode is bypassed. In order to prevent such an occurrence, a further filter S7 is located between all communicating processes, and stops any request that is passed on to one process to the other (in the example, from APP1 to APPX), and which the first process is not allowed to make directly. - Of course, as will be apparent to the skilled person, the filter S7 is not a physical filter, but rather a logical one. Logical filters of this kind can be provided in a plurality of ways, using many different analysis processes and criteria, which will be predetermined by the skilled person according to the particular requirements of the system involved.
- All the above description and examples have therefore been provided for the purpose of illustration only, and are not intended to limit the invention in any way, except as defined by the appended claims.
Claims (29)
1. (canceled)
2. (canceled)
3. (canceled)
4. (canceled)
5. (canceled)
6. (canceled)
7. (canceled)
8. (canceled)
9. A method for preventing hostile use of computer resources by an application running on a workstation, comprising:
providing a filter on a workstation for receiving internal requests for computer resources resident on the workstation;
receiving at the filter a request for access from an application resident on the workstation, the request for access identifying a computer resource resident on the workstation,
determining if the request for access has exceeded a pre-set threshold identifying a limited number of processes that may be initiated by the application;
allowing access to the requested computer resource if the request for access has not exceeded the pre-set threshold; and
preventing access to the requested computer resource if the request for access has exceeded the pre-set threshold.
10. The method of claim 9 , wherein the application from which the request for access is received comprises an unspecified application downloaded to the workstation from a source external to the workstation, the unspecified application not identifiable in a pre-set list of hostile applications.
11. The method of claim 9 , wherein the requested computer resource is selected from the group consisting of a memory allocation, a file, and a directory.
12. The method of claim 9 , wherein the requested computer resource is selected from the group consisting of a copy command, a delete command, and a compress command.
13. The method of claim 9 , wherein the requested computer resource comprises an operation that when performed leads to a permanent change in the workstation.
14. The method of claim 9 , wherein receiving the request comprises receiving a direct request generated by the unspecified application.
15. The method of claim 9 , wherein receiving the request comprises receiving an indirect request generated by the unspecified application.
16. A workstation for preventing hostile use of computer resources by an application running on the workstation, comprising:
a memory operable to store one or more applications; and
a processor in communication with the memory and operable to:
in response to a received request for access, determine if the request has exceeded a pre-set threshold identifying a limited number of processes that may be initiated by an application;
allow access to the requested computer resource if the request for access has not exceeded the pre-set threshold; and
prevent access to the requested computer resource if the request for access has exceeded the pre-set threshold.
17. The workstation of claim 16 , wherein at least one of the one or more applications comprise an unspecified application downloaded to the workstation from a source external to the workstation, the unspecified application not identifiable in a pre-set list of hostile applications.
18. The workstation of claim 16 , wherein the requested computer resource is selected from the group consisting of a memory allocation, a file, and a directory.
19. The workstation of claim 16 , wherein the requested computer resource is selected from the group consisting of a copy command, a delete command, and a compress command.
20. The workstation of claim 16 , wherein the requested computer resource comprises an operation that when performed leads to a permanent change in the workstation.
21. The workstation of claim 16 , wherein the request from the unspecified application comprises a direct request.
22. The workstation of claim 16 , wherein the request from the unspecified application comprises an indirect request.
23. Logic for preventing hostile use of computer resources by an application running on a workstation, the logic encoded in media and operable when executed to:
provide a filter on a workstation for receiving internal requests for computer resources resident on the workstation;
receive at the filter a request for access from an application resident on the workstation, the request for access identifying a computer resource resident on the workstation,
determine if the request for access has exceeded a pre-set threshold identifying a limited number of processes that may be initiated by the application;
allow access to the requested computer resource if the request for access has not exceeded the pre-set threshold; and
prevent access to the requested computer resource if the request for access has exceeded the pre-set threshold.
24. The logic of claim 23 , wherein the application from which the request for access is received comprises an unspecified application downloaded to the workstation from a source external to the workstation, the unspecified application not identifiable in a pre-set list of hostile applications.
25. The logic of claim 23 , wherein the requested computer resource is selected from the group consisting of a memory allocation, a file, and a directory.
26. The logic of claim 23 , wherein the requested computer resource is selected from the group consisting of a copy command, a delete command, and a compress command.
27. The logic of claim 23 , wherein the requested computer resource comprises an operation that when performed leads to a permanent change in the workstation.
28. The logic of claim 23 , wherein receiving the request comprises receiving a direct request generated by the unspecified application.
29. The logic of claim 23 , wherein receiving the request comprises receiving an indirect request generated by the unspecified application.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US12/111,678 US20080201777A1 (en) | 1998-03-02 | 2008-04-29 | Method and Agent for the Protection Against the Unauthorized Use of Computer Resources |
Applications Claiming Priority (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
IL12351298A IL123512A0 (en) | 1998-03-02 | 1998-03-02 | Method and agent for the protection against hostile resource use access |
IL123512 | 1998-03-02 | ||
ILPCT/IL99/00113 | 1999-02-25 | ||
PCT/IL1999/000113 WO1999045454A1 (en) | 1998-03-02 | 1999-02-25 | Method and agent for the protection against the unauthorised use of computer resources |
US62295900A | 2000-12-11 | 2000-12-11 | |
US12/111,678 US20080201777A1 (en) | 1998-03-02 | 2008-04-29 | Method and Agent for the Protection Against the Unauthorized Use of Computer Resources |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US62295900A Division | 1998-03-02 | 2000-12-11 |
Publications (1)
Publication Number | Publication Date |
---|---|
US20080201777A1 true US20080201777A1 (en) | 2008-08-21 |
Family
ID=11071290
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/622,959 Expired - Fee Related US7383569B1 (en) | 1998-03-02 | 1999-02-25 | Method and agent for the protection against the unauthorized use of computer resources |
US12/111,678 Abandoned US20080201777A1 (en) | 1998-03-02 | 2008-04-29 | Method and Agent for the Protection Against the Unauthorized Use of Computer Resources |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/622,959 Expired - Fee Related US7383569B1 (en) | 1998-03-02 | 1999-02-25 | Method and agent for the protection against the unauthorized use of computer resources |
Country Status (10)
Country | Link |
---|---|
US (2) | US7383569B1 (en) |
EP (1) | EP1068566A1 (en) |
JP (1) | JP2002506247A (en) |
KR (1) | KR20010041448A (en) |
CN (1) | CN1299478A (en) |
AU (1) | AU767894B2 (en) |
BR (1) | BR9908454A (en) |
CA (1) | CA2321987A1 (en) |
IL (1) | IL123512A0 (en) |
WO (1) | WO1999045454A1 (en) |
Families Citing this family (42)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
GB2350971A (en) | 1999-06-07 | 2000-12-13 | Nokia Mobile Phones Ltd | Security Architecture |
JP2004528609A (en) * | 2000-05-24 | 2004-09-16 | ボルテール アドバンスト データ セキュリティ リミテッド | Inter-application communication with filtering |
US7660902B2 (en) * | 2000-11-20 | 2010-02-09 | Rsa Security, Inc. | Dynamic file access control and management |
US7958237B2 (en) * | 2001-01-23 | 2011-06-07 | Pearl Software, Inc. | Method for managing computer network access |
JP2003067210A (en) * | 2001-08-22 | 2003-03-07 | Just Syst Corp | Program execution prevention device, program execution prevention method, program for computer to execute the method, and computer readable recording medium stored with the program |
JP4007873B2 (en) | 2002-07-09 | 2007-11-14 | 富士通株式会社 | Data protection program and data protection method |
FR2843465B1 (en) * | 2002-08-06 | 2005-07-01 | Checkflow | METHOD FOR COMMUNICATING BETWEEN APPLICATIONS TO SECURE ACCESS TO APPLICATION DATA |
JP2004157892A (en) | 2002-11-08 | 2004-06-03 | Hitachi Ltd | Computer system, storage device, access management method and program |
US9487823B2 (en) | 2002-12-20 | 2016-11-08 | Qiagen Gmbh | Nucleic acid amplification |
US7955795B2 (en) | 2003-06-06 | 2011-06-07 | Qiagen Gmbh | Method of whole genome amplification with reduced artifact production |
ATE394750T1 (en) * | 2003-06-30 | 2008-05-15 | Nxp Bv | DIGITAL SELF-ERASE OF KEY COPY PROTECTED MEMORY. |
AU2003298193A1 (en) * | 2003-12-17 | 2005-07-05 | Telecom Italia S.P.A. | Method and apparatus for monitoring operation of processing systems, related network and computer program product therefor |
JP4164036B2 (en) | 2004-02-05 | 2008-10-08 | トレンドマイクロ株式会社 | Ensuring security on the receiving device for programs provided via the network |
WO2005078571A2 (en) * | 2004-02-09 | 2005-08-25 | Palmsource, Inc. | A method and graphics subsystem for a computing device |
US7735085B2 (en) * | 2004-05-26 | 2010-06-08 | Qualcomm Incorporated | System for application priority based on device operating mode |
US20060069754A1 (en) * | 2004-06-30 | 2006-03-30 | Keith Buck | Enablement of software-controlled services required by installed applications |
US7451435B2 (en) * | 2004-12-07 | 2008-11-11 | Microsoft Corporation | Self-describing artifacts and application abstractions |
US8046831B2 (en) * | 2005-03-02 | 2011-10-25 | Actiance, Inc. | Automating software security restrictions on system resources |
US7870613B2 (en) | 2005-03-02 | 2011-01-11 | Facetime Communications, Inc. | Automating software security restrictions on applications |
US8078740B2 (en) * | 2005-06-03 | 2011-12-13 | Microsoft Corporation | Running internet applications with low rights |
JP4741292B2 (en) | 2005-06-09 | 2011-08-03 | 株式会社日立製作所 | Device management system |
US8849968B2 (en) | 2005-06-20 | 2014-09-30 | Microsoft Corporation | Secure and stable hosting of third-party extensions to web services |
US7603708B2 (en) * | 2005-07-13 | 2009-10-13 | Microsoft Corporation | Securing network services using network action control lists |
US8320880B2 (en) | 2005-07-20 | 2012-11-27 | Qualcomm Incorporated | Apparatus and methods for secure architectures in wireless networks |
EP1762627A1 (en) | 2005-09-09 | 2007-03-14 | Qiagen GmbH | Method for the activation of a nucleic acid for performing a polymerase reaction |
US8074231B2 (en) | 2005-10-26 | 2011-12-06 | Microsoft Corporation | Configuration of isolated extensions and device drivers |
EP1788505A1 (en) * | 2005-11-21 | 2007-05-23 | Research In Motion Limited | System and method for application program operation on a wireless device |
US8045958B2 (en) | 2005-11-21 | 2011-10-25 | Research In Motion Limited | System and method for application program operation on a wireless device |
DE602006006787D1 (en) | 2006-02-27 | 2009-06-25 | Research In Motion Ltd | Method for personalizing a standardized IT policy |
US20070250495A1 (en) * | 2006-04-25 | 2007-10-25 | Eran Belinsky | Method and System For Accessing Referenced Information |
US8032898B2 (en) | 2006-06-30 | 2011-10-04 | Microsoft Corporation | Kernel interface with categorized kernel objects |
US9021590B2 (en) * | 2007-02-28 | 2015-04-28 | Microsoft Technology Licensing, Llc | Spyware detection mechanism |
US8789063B2 (en) | 2007-03-30 | 2014-07-22 | Microsoft Corporation | Master and subordinate operating system kernels for heterogeneous multiprocessor systems |
US9137664B2 (en) * | 2007-05-01 | 2015-09-15 | Qualcomm Incorporated | Application logging interface for a mobile device |
US10019570B2 (en) | 2007-06-14 | 2018-07-10 | Microsoft Technology Licensing, Llc | Protection and communication abstractions for web browsers |
US8549631B2 (en) | 2009-02-12 | 2013-10-01 | Ahnlab, Inc. | Internet site security system and method thereto |
US9712530B2 (en) | 2012-01-06 | 2017-07-18 | Optio Labs, Inc. | Systems and methods for enforcing security in mobile computing |
US9609020B2 (en) | 2012-01-06 | 2017-03-28 | Optio Labs, Inc. | Systems and methods to enforce security policies on the loading, linking, and execution of native code by mobile applications running inside of virtual machines |
US9787681B2 (en) | 2012-01-06 | 2017-10-10 | Optio Labs, Inc. | Systems and methods for enforcing access control policies on privileged accesses for mobile devices |
US9773107B2 (en) | 2013-01-07 | 2017-09-26 | Optio Labs, Inc. | Systems and methods for enforcing security in mobile computing |
US11070591B2 (en) * | 2017-02-10 | 2021-07-20 | Zscaler, Inc. | Distributed network application security policy enforcement |
EP3641259A1 (en) * | 2018-10-15 | 2020-04-22 | Siemens Aktiengesellschaft | Apparatus and method for testing properties of resources |
Citations (28)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4574360A (en) * | 1983-04-01 | 1986-03-04 | Sundstrand Data Control, Inc. | Helicopter weight measuring system |
US4574350A (en) * | 1982-05-19 | 1986-03-04 | At&T Bell Laboratories | Shared resource locking apparatus |
US5032979A (en) * | 1990-06-22 | 1991-07-16 | International Business Machines Corporation | Distributed security auditing subsystem for an operating system |
US5062055A (en) * | 1986-09-02 | 1991-10-29 | Digital Equipment Corporation | Data processor performance advisor |
US5097533A (en) * | 1988-11-29 | 1992-03-17 | International Business Machines Corporation | System and method for interfacing computer application programs written in different languages to a software system |
US5307497A (en) * | 1990-06-25 | 1994-04-26 | International Business Machines Corp. | Disk operating system loadable from read only memory using installable file system interface |
US5412717A (en) * | 1992-05-15 | 1995-05-02 | Fischer; Addison M. | Computer system security method and apparatus having program authorization information data structures |
US5483658A (en) * | 1993-02-26 | 1996-01-09 | Grube; Gary W. | Detection of unauthorized use of software applications in processing devices |
US5524242A (en) * | 1990-08-09 | 1996-06-04 | Hitachi, Ltd. | System and method for determining the number of parallel processes to be created according to run cost value and parallelization overhead |
US5559726A (en) * | 1994-09-06 | 1996-09-24 | International Business Machines Corporation | Method and system for detecting whether a parameter is set appropriately in a computer system |
US5630128A (en) * | 1991-08-09 | 1997-05-13 | International Business Machines Corporation | Controlled scheduling of program threads in a multitasking operating system |
US5701463A (en) * | 1994-09-09 | 1997-12-23 | Cheyenne Advanced Technology Limited | Method of replacing the identity of a file with another as part of a file open request in a computer system |
US5835765A (en) * | 1995-05-31 | 1998-11-10 | Mitsubishi Denki Kabushiki Kaisha | Computer operation management system for a computer operating system capable of simultaneously executing plural application programs |
US5859966A (en) * | 1995-10-10 | 1999-01-12 | Data General Corporation | Security system for computer systems |
US5895966A (en) * | 1995-09-29 | 1999-04-20 | Analog Devices, Inc. | Integrated circuit and supply decoupling capacitor therefor |
US5944821A (en) * | 1996-07-11 | 1999-08-31 | Compaq Computer Corporation | Secure software registration and integrity assessment in a computer system |
US5961582A (en) * | 1994-10-25 | 1999-10-05 | Acorn Technologies, Inc. | Distributed and portable execution environment |
US5964876A (en) * | 1997-06-16 | 1999-10-12 | Mitsubishi Electric Semiconductor Software Co., Ltd. | Program-invocation-count measuring system, program-invocation-count measuring method, and medium for storing program-invocation-count measuring software |
US5968175A (en) * | 1994-03-29 | 1999-10-19 | Kabushiki Kaisha Toshiba | Software use method control system |
US5987523A (en) * | 1997-06-04 | 1999-11-16 | International Business Machines Corporation | Applet redirection for controlled access to non-orginating hosts |
US6092194A (en) * | 1996-11-08 | 2000-07-18 | Finjan Software, Ltd. | System and method for protecting a computer and a network from hostile downloadables |
US6178449B1 (en) * | 1997-11-26 | 2001-01-23 | International Business Machines Corporation | Apparatus and method for measuring transaction time in a computer system |
US6212581B1 (en) * | 1994-05-05 | 2001-04-03 | Openservice, Inc. | Method and system for managing a group of computers |
US6233576B1 (en) * | 1995-06-09 | 2001-05-15 | International Business Machines Corporation | Enhanced security for computer system resources with a resource access authorization control facility that creates files and provides increased granularity of resource permission |
US6438573B1 (en) * | 1996-10-09 | 2002-08-20 | Iowa State University Research Foundation, Inc. | Real-time programming method |
US6449723B1 (en) * | 1997-03-10 | 2002-09-10 | Computer Associates Think, Inc. | Method and system for preventing the downloading and execution of executable objects |
US6601083B1 (en) * | 1996-08-29 | 2003-07-29 | Frederick John Reznak | Multitasking data processing system and method of controlling allocation of a shared resource |
US6845505B1 (en) * | 1997-02-03 | 2005-01-18 | Oracle International Corporation | Web request broker controlling multiple processes |
Family Cites Families (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0456386B1 (en) | 1990-05-11 | 1998-11-11 | International Computers Limited | Access control in a distributed computer system |
GB9205774D0 (en) * | 1992-03-17 | 1992-04-29 | Int Computers Ltd | Computer security system |
DE69323926T2 (en) | 1992-05-15 | 1999-09-30 | Addison M Fischer | Method and device for the security of a computer system with program authorization data structures |
WO1997004394A1 (en) | 1995-07-14 | 1997-02-06 | Christopher Nathan Drake | Computer software authentication, protection, and security system |
CA2202118A1 (en) | 1996-04-29 | 1997-10-29 | Mitel Corporation | Protected persistent storage access for mobile applications |
US6167522A (en) * | 1997-04-01 | 2000-12-26 | Sun Microsystems, Inc. | Method and apparatus for providing security for servers executing application programs received via a network |
US5983348A (en) * | 1997-09-10 | 1999-11-09 | Trend Micro Incorporated | Computer network malicious code scanner |
-
1998
- 1998-03-02 IL IL12351298A patent/IL123512A0/en not_active IP Right Cessation
-
1999
- 1999-02-25 CN CN99805763A patent/CN1299478A/en active Pending
- 1999-02-25 US US09/622,959 patent/US7383569B1/en not_active Expired - Fee Related
- 1999-02-25 EP EP99906428A patent/EP1068566A1/en not_active Ceased
- 1999-02-25 KR KR1020007009598A patent/KR20010041448A/en not_active Application Discontinuation
- 1999-02-25 WO PCT/IL1999/000113 patent/WO1999045454A1/en not_active Application Discontinuation
- 1999-02-25 BR BR9908454-6A patent/BR9908454A/en not_active IP Right Cessation
- 1999-02-25 CA CA002321987A patent/CA2321987A1/en not_active Abandoned
- 1999-02-25 JP JP2000534932A patent/JP2002506247A/en active Pending
- 1999-02-25 AU AU26373/99A patent/AU767894B2/en not_active Ceased
-
2008
- 2008-04-29 US US12/111,678 patent/US20080201777A1/en not_active Abandoned
Patent Citations (28)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4574350A (en) * | 1982-05-19 | 1986-03-04 | At&T Bell Laboratories | Shared resource locking apparatus |
US4574360A (en) * | 1983-04-01 | 1986-03-04 | Sundstrand Data Control, Inc. | Helicopter weight measuring system |
US5062055A (en) * | 1986-09-02 | 1991-10-29 | Digital Equipment Corporation | Data processor performance advisor |
US5097533A (en) * | 1988-11-29 | 1992-03-17 | International Business Machines Corporation | System and method for interfacing computer application programs written in different languages to a software system |
US5032979A (en) * | 1990-06-22 | 1991-07-16 | International Business Machines Corporation | Distributed security auditing subsystem for an operating system |
US5307497A (en) * | 1990-06-25 | 1994-04-26 | International Business Machines Corp. | Disk operating system loadable from read only memory using installable file system interface |
US5524242A (en) * | 1990-08-09 | 1996-06-04 | Hitachi, Ltd. | System and method for determining the number of parallel processes to be created according to run cost value and parallelization overhead |
US5630128A (en) * | 1991-08-09 | 1997-05-13 | International Business Machines Corporation | Controlled scheduling of program threads in a multitasking operating system |
US5412717A (en) * | 1992-05-15 | 1995-05-02 | Fischer; Addison M. | Computer system security method and apparatus having program authorization information data structures |
US5483658A (en) * | 1993-02-26 | 1996-01-09 | Grube; Gary W. | Detection of unauthorized use of software applications in processing devices |
US5968175A (en) * | 1994-03-29 | 1999-10-19 | Kabushiki Kaisha Toshiba | Software use method control system |
US6212581B1 (en) * | 1994-05-05 | 2001-04-03 | Openservice, Inc. | Method and system for managing a group of computers |
US5559726A (en) * | 1994-09-06 | 1996-09-24 | International Business Machines Corporation | Method and system for detecting whether a parameter is set appropriately in a computer system |
US5701463A (en) * | 1994-09-09 | 1997-12-23 | Cheyenne Advanced Technology Limited | Method of replacing the identity of a file with another as part of a file open request in a computer system |
US5961582A (en) * | 1994-10-25 | 1999-10-05 | Acorn Technologies, Inc. | Distributed and portable execution environment |
US5835765A (en) * | 1995-05-31 | 1998-11-10 | Mitsubishi Denki Kabushiki Kaisha | Computer operation management system for a computer operating system capable of simultaneously executing plural application programs |
US6233576B1 (en) * | 1995-06-09 | 2001-05-15 | International Business Machines Corporation | Enhanced security for computer system resources with a resource access authorization control facility that creates files and provides increased granularity of resource permission |
US5895966A (en) * | 1995-09-29 | 1999-04-20 | Analog Devices, Inc. | Integrated circuit and supply decoupling capacitor therefor |
US5859966A (en) * | 1995-10-10 | 1999-01-12 | Data General Corporation | Security system for computer systems |
US5944821A (en) * | 1996-07-11 | 1999-08-31 | Compaq Computer Corporation | Secure software registration and integrity assessment in a computer system |
US6601083B1 (en) * | 1996-08-29 | 2003-07-29 | Frederick John Reznak | Multitasking data processing system and method of controlling allocation of a shared resource |
US6438573B1 (en) * | 1996-10-09 | 2002-08-20 | Iowa State University Research Foundation, Inc. | Real-time programming method |
US6092194A (en) * | 1996-11-08 | 2000-07-18 | Finjan Software, Ltd. | System and method for protecting a computer and a network from hostile downloadables |
US6845505B1 (en) * | 1997-02-03 | 2005-01-18 | Oracle International Corporation | Web request broker controlling multiple processes |
US6449723B1 (en) * | 1997-03-10 | 2002-09-10 | Computer Associates Think, Inc. | Method and system for preventing the downloading and execution of executable objects |
US5987523A (en) * | 1997-06-04 | 1999-11-16 | International Business Machines Corporation | Applet redirection for controlled access to non-orginating hosts |
US5964876A (en) * | 1997-06-16 | 1999-10-12 | Mitsubishi Electric Semiconductor Software Co., Ltd. | Program-invocation-count measuring system, program-invocation-count measuring method, and medium for storing program-invocation-count measuring software |
US6178449B1 (en) * | 1997-11-26 | 2001-01-23 | International Business Machines Corporation | Apparatus and method for measuring transaction time in a computer system |
Non-Patent Citations (2)
Title |
---|
Dan et al, ChakraVyuha: A Sandbox Operating System Environment for Controlled Execution of Alien Code: IBM Research Report RC 20742 (2/20/97): * |
Yue et al - Loop-Level Process Control: An Effective Processor Allocation Policy for Multiprogrammed Shared-Memory Multiprocessors, Workshop on Job Scheduling Strategies for Parallel Processing, IPPS, April, 1995. * |
Also Published As
Publication number | Publication date |
---|---|
CA2321987A1 (en) | 1999-09-10 |
JP2002506247A (en) | 2002-02-26 |
AU767894B2 (en) | 2003-11-27 |
CN1299478A (en) | 2001-06-13 |
IL123512A0 (en) | 1999-03-12 |
WO1999045454A1 (en) | 1999-09-10 |
US7383569B1 (en) | 2008-06-03 |
BR9908454A (en) | 2000-11-14 |
AU2637399A (en) | 1999-09-20 |
KR20010041448A (en) | 2001-05-25 |
EP1068566A1 (en) | 2001-01-17 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7383569B1 (en) | Method and agent for the protection against the unauthorized use of computer resources | |
US6584508B1 (en) | Advanced data guard having independently wrapped components | |
US7831995B2 (en) | Establishing and enforcing security and privacy policies in web-based applications | |
US8161563B2 (en) | Running internet applications with low rights | |
Bishop | A standard audit trail format | |
US7398532B1 (en) | System and method for establishing a secure execution environment for a software process | |
US20070050781A1 (en) | Control method of application program and apparatus therefor | |
Neumann | Computer system-Security evaluation | |
US20060230234A1 (en) | Browser cache management | |
US7793349B2 (en) | System for prevention of buffer overflow intrusions | |
JP2002517852A (en) | Method and system for securely executing untrusted content | |
US9038161B2 (en) | Exploit nonspecific host intrusion prevention/detection methods and systems and smart filters therefor | |
US8387111B2 (en) | Type independent permission based access control | |
US7076557B1 (en) | Applying a permission grant set to a call stack during runtime | |
US7146641B2 (en) | Method and system for the prevention of undesirable activities of executable objects | |
Melliar-Smith et al. | Protection against covert storage and timing channels | |
JP2003513349A (en) | Method and system for verifying client request | |
Niinimaki et al. | Java applets and security | |
Skoularidou et al. | Securing the network client | |
Evans | Hostile Java Applets Hostile Java Applets | |
Haugh et al. | Document History | |
Evans | Hostile Java Applets | |
DE10229114A1 (en) | Operating system administering method in computer, involves manipulating compartments of operating system associating with different processes by command-line utility |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |