-
公开(公告)号：US12099862B2
公开(公告)日：2024-09-24
申请号：US17322957
申请日：2021-05-18
Applicant: VMWARE, INC.
Inventor： Goresh Musalay , Sachin Shinde , Zubraj Singha , Tanay Ganguly , Kashish Bhatia
CPC classification number: G06F9/45558 , G06F9/45545 , G06F9/5016 , G06F9/5077 , G06F21/6209 , G06F2009/45583
Abstract: Example methods are provided to identify unused memory regions in pages that are allocated for storing executable code. One or more of the unused memory regions are usable as a secure location to store confidential information shared between a hypervisor on the host and a guest (such as a guest virtual computing instance) that runs on the host. The one or more unused memory regions may also be used to store executable code (such as valid executable code of antivirus software or other security program) that has been prevented/delayed in its execution by malicious code that has occupied the pages, thereby providing the executable code with sufficient memory resources to enable the executable code to at least partially complete execution.
-
公开(公告)号：US12095629B2
公开(公告)日：2024-09-17
申请号：US16878652
申请日：2020-05-20
Applicant: VMWARE, INC.
Inventor： Nakul Ogale , Shirish Vijayvargiya , Sachin Shinde
IPC: H04L12/24 , G06F9/455 , H04L29/12 , H04L41/046 , H04L41/28 , H04L61/4511
CPC classification number: H04L41/28 , G06F9/45558 , H04L41/046 , H04L61/4511 , G06F2009/45587 , G06F2009/45595
Abstract: Example methods and systems for a computer system to perform security threat detection during service query handling are described. In one example, a process running on a virtualized computing instance supported by the computer system may generate and send a first service query specifying a query input according to a service protocol. The first service query may be detected by a security agent configured to operate in a secure enclave that is isolated from the process. Next, the security agent may generate and send a second service query specifying the query input in the first service query. It is then determined whether there is a potential security threat based on a comparison between (a) a first reply received responsive to the first service query and (b) a second reply received responsive to the second service query.
-
公开(公告)号：US11847221B2
公开(公告)日：2023-12-19
申请号：US17241000
申请日：2021-04-26
Applicant: VMware, Inc.
Inventor： Mandar Nanivadekar , Bharath Kumar Chandrasekhar , Sachin Shinde
CPC classification number: G06F21/565 , G06F21/53 , G06F2221/034
Abstract: System and method for executing scan operations on computing systems use a sparse file that represents a storage device of a computing system to scan a file stored in the storage device. The sparse file is created and mounted to a scanner appliance such that the sparse file appears to a scan engine of the scanner appliance as a local storage device. When a read request for the file stored in the storage device is issued from the scan engine that results in an implicit read request to the sparse file, the implicit read request is trapped. While the implicit read request is trapped, data of the file is retrieved from the storage device of the computing system to the scanner appliance using a communication transport. The retrieved data of the file is then scanned using the scan engine at the scanner appliance.
-
公开(公告)号：US11645400B2
公开(公告)日：2023-05-09
申请号：US16693407
申请日：2019-11-25
Applicant: VMWARE, INC.
Inventor： Sachin Shinde , Shirish Vijayvargiya
CPC classification number: G06F21/606 , G06F9/541 , G06F9/45558 , G06F2009/45562 , G06F2009/45583 , G06F2009/45587
Abstract: The present disclosure describes secured interprocess communication (IPC). The operating system traps application-level IPC calls to an IPC agent, which handles the IPC call. The IPC agent executes in a trusted execution environment so that communications between the applications involved in the IPC are secure. Since processing of IPC by the IPC agent bypasses the operating system, IPC remains secure despite any attacks against the operating system code.
-
公开(公告)号：US20230027307A1
公开(公告)日：2023-01-26
申请号：US17496781
申请日：2021-10-08
Applicant: VMWARE, INC.
Inventor： Sachin Shinde , Zubraj Singha , Goresh Musalay , Tanay Ganguly , Kashish Bhatia
IPC: G06F9/455
Abstract: An example method of providing a transient cache in system memory of a host for swap space on storage accessible by the host, the method including: identifying, by transient cache drivers executing in virtual machines (VMs) supported by a hypervisor executing on the host, unused space in code pages of a plurality of processes executing in the VMs; sending, from the transient cache drivers to a transient cache manager of the hypervisor, unused space metadata describing the unused space; creating, by the transient cache manager based on the unused space metadata, the transient cache in the system memory by aggregating the unused space; and providing, to a first transient cache driver of the transient cache drivers executing in a first VM of the VMs, information for accessing the transient cache.
-
Patent Agency Ranking
公开(公告)号：US20220300314A1
公开(公告)日：2022-09-22
申请号：US17322957
申请日：2021-05-18
Applicant: VMWARE, INC.
Inventor： Goresh Musalay , Sachin Shinde , Zubraj Singha , Tanay Ganguly , Kashish Bhatia
Abstract: Example methods are provided to identify unused memory regions in pages that are allocated for storing executable code. One or more of the unused memory regions are usable as a secure location to store confidential information shared between a hypervisor on the host and a guest (such as a guest virtual computing instance) that runs on the host. The one or more unused memory regions may also be used to store executable code (such as valid executable code of antivirus software or other security program) that has been prevented/delayed in its execution by malicious code that has occupied the pages, thereby providing the executable code with sufficient memory resources to enable the executable code to at least partially complete execution.
-
公开(公告)号：US20200218792A1
公开(公告)日：2020-07-09
申请号：US16296273
申请日：2019-03-08
Applicant: VMWARE, INC.
Inventor： ALOK NEMCHAND KATARIA , Achindra Bhatnagar , Sachin Shinde , Martim Carbone , Deep Shah
Abstract: Techniques for verifying the integrity of application data using secure hardware enclaves are provided. In one set of embodiments, a client system can create a secure hardware enclave on the client system and load program code for an integrity verifier into the secure hardware enclave. The client system can further receive a dataset from a server system and store the dataset at a local storage or memory location, and receive, via the integrity verifier, a cryptographic hash of the dataset from the server system and store the received cryptographic hash at a memory location within the secure hardware enclave. Then, on a periodic basis, the integrity verifier can compute a cryptographic hash of the stored dataset, compare the computed cryptographic hash against the stored cryptographic hash, and if the computed cryptographic hash does not match the stored cryptographic hash, determine that the stored dataset has been modified.
-
公开(公告)号：US20190384914A1
公开(公告)日：2019-12-19
申请号：US16215612
申请日：2018-12-10
Applicant: VMware Inc.
Inventor： Nilesh Awate , Goresh Musalay , Sachin Shinde , VSV Vijay
Abstract: Methods and apparatus to validate and restore machine configurations are disclosed herein. An example apparatus includes a context identifier to obtain first context information for a first set of configuration update events occurring on a computing device, a guest agent interface to transmit the first set of configuration update events to a security manager for generation of a policy, the policy including allowable configuration update events and responses to unallowable configuration update events, an event comparator to compare second context information of a subsequent configuration update event obtained by the context identifier to the policy received from the security manager, and an event handler to determine, when the subsequent configuration update event is not included in the policy, that the subsequent configuration update event is to be transmitted to the security manager for generation of an updated policy.
-
19.发明授权公开(公告)号：US12254091B2
公开(公告)日：2025-03-18
申请号：US17979482
申请日：2022-11-02
Applicant: VMware, Inc.
Inventor： Mandar Nanivadekar , Sachin Shinde , Bharath Kumar Chandrasekhar
Abstract: A method of protecting an endpoint against a security threat detected at the endpoint, wherein the endpoint includes, in memory pages of the endpoint, an operating system (OS), a separate software entity, and remediation code, includes the steps of: transferring control of virtual CPUs (vCPUs) of the endpoint from the OS to the separate software entity; and while the separate software entity controls the vCPUs, storing, in an interrupt dispatch table, an instruction address corresponding to an interrupt, wherein the remediation code is stored at the instruction address, and replacing a next instruction to be executed by the OS, with an interrupt instruction, wherein the interrupt is raised when the OS executes the interrupt instruction, and the remediation code is executed as a result of handling of the interrupt that is raised.
-
公开(公告)号：US20240134961A1
公开(公告)日：2024-04-25
申请号：US17970168
申请日：2022-10-19
Applicant: VMware, Inc
Inventor： Sachin Shinde , Shirish Vijayvargiya , Amardeep Nagarkar , Sunil Hasbe
Abstract: The current document is directed to automated methods and systems that monitor system-call execution by operating systems in order to detect operating-system corruption. A disclosed implementation of the currently disclosed automated system-call-integrity monitor generate operational system-call fingerprints for randomly selected system calls executed by guest operating systems of randomly selected virtual machines and compares the operational system-call fingerprints to reference system-call fingerprints in order to detect operational anomalies of guest operating systems that are likely to represent guest-operating-system corruption. In disclosed implementations, a system-call fingerprint includes a system-call execution time, the number of instructions executed during execution of the system call, and a snapshot of the call stack taken during execution of the system call. The currently disclosed methods and systems can be used to monitor the system-call integrity of discrete computer systems, including personal computers, as well as computer-system clusters and aggregations.
-
-
-
-
-
-
-
-
-
Search Results
24
records
(took 0.018 seconds)
