利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

37 条记录 (耗时 0.041 秒)

    System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies
    1.
    发明申请
    System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies 审中-公开
    用于同时定义和执行访问控制和完整性政策的系统，方法和装置

    公开(公告)号：US20150089637A1

    公开(公告)日：2015-03-26

    申请号：US14033502

    申请日：2013-09-22

    申请人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    发明人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    IPC分类号： G06F21/57

    CPC分类号： G06F21/57 ,  G06F21/51 ,  G06F21/604 ,  H04L63/102 ,  H04L63/20

    摘要： Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions.

    摘要翻译： 访问控制和信息流完整性策略在计算系统中通过检测在计算系统上运行的应用的软件代码中的安全敏感的汇和从计算系统可访问的数据库检索访问控制策略来实施。 访问控制策略将计算系统内的一组访问权限映射到多个主体中的每一个。 对于每个检测到的安全敏感接收器，检测到影响该安全敏感信宿的所有主体，并通过对该安全敏感信宿的所有影响主体的访问权限集合的交集来分配每个安全敏感信宿的总访问权限 水槽。 如果此权限集不足，则会报告完整性违规。 此外，权限标签分配给在安全敏感的接收器中使用的变量的每个值。 每个权限标签都是一组权限。

    Eliminating false reports of security vulnerabilities when testing computer software
    2.
    发明授权
    Eliminating false reports of security vulnerabilities when testing computer software 失效
    在测试计算机软件时，消除安全漏洞的虚假报告

    公开(公告)号：US08584246B2

    公开(公告)日：2013-11-12

    申请号：US12578013

    申请日：2009-10-13

    申请人： Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Takaaki Tateishi ,  Omer Tripp ,  Omri Weisman

    发明人： Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Takaaki Tateishi ,  Omer Tripp ,  Omri Weisman

    IPC分类号： G06F12/14

    CPC分类号： G06F21/57 ,  G06F11/3692

    摘要： A system for eliminating false reports of security vulnerabilities when testing computer software, including a taint analysis engine configured to identify a tainted variable v in a computer application, a data mapping identification engine configured to identify a variable x within the application that holds data derived from v, where x is in a different format than v, an AddData identification engine configured to identify an AddData operation within the application that is performed on x, a signature identification engine configured to identify a Sign operation within the application that is performed on the results of the AddData operation on x, a signature comparison identification engine configured to identify an operation within the application that compares the results of the Sign operation with another value.

    摘要翻译： 一种用于在测试计算机软件时消除安全漏洞的虚假报告的系统，包括配置成识别计算机应用程序中的受污染变量v的污染分析引擎，配置为识别应用程序内的变量x，该变量x保存从 v，其中x与v不同的格式，被配置为识别在x上执行的应用程序内的AddData操作的AddData识别引擎，被配置为识别在结果上执行的应用程序内的签名操作的签名识别引擎 的签名比较识别引擎，所述签名比较识别引擎被配置为识别应用程序内将所述Sign操作的结果与另一值进行比较的操作。

    System, method and apparatus for simultaneous definition and enforcement of access-control and integrity policies
    3.
    发明授权
    System, method and apparatus for simultaneous definition and enforcement of access-control and integrity policies 失效
    用于同时定义和执行访问控制和完整性策略的系统，方法和装置

    公开(公告)号：US08572727B2

    公开(公告)日：2013-10-29

    申请号：US12624172

    申请日：2009-11-23

    申请人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    发明人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    IPC分类号： G06F21/00

    CPC分类号： G06F21/57 ,  G06F21/51 ,  G06F21/604 ,  H04L63/102 ,  H04L63/20

    摘要： Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions.

    摘要翻译： 访问控制和信息流完整性策略在计算系统中通过检测在计算系统上运行的应用的软件代码中的安全敏感的汇和从计算系统可访问的数据库检索访问控制策略来实施。 访问控制策略将计算系统内的一组访问权限映射到多个主体中的每一个。 对于每个检测到的安全敏感接收器，检测到影响该安全敏感信宿的所有主体，并通过对该安全敏感信宿的所有影响主体的访问权限集合的交集来分配每个安全敏感信宿的总访问权限 水槽。 如果此权限集不足，则会报告完整性违规。 此外，权限标签分配给在安全敏感的接收器中使用的变量的每个值。 每个权限标签都是一组权限。

    PINPOINTING SECURITY VULNERABILITIES IN COMPUTER SOFTWARE APPLICATIONS
    5.
    发明申请
    PINPOINTING SECURITY VULNERABILITIES IN COMPUTER SOFTWARE APPLICATIONS 有权
    在计算机软件应用程序中确定安全漏洞

    公开(公告)号：US20120266248A1

    公开(公告)日：2012-10-18

    申请号：US13411083

    申请日：2012-03-02

    申请人： Yair Amit ,  Roee Hay ,  Roi Saltzman ,  Adi Sharabani

    发明人： Yair Amit ,  Roee Hay ,  Roi Saltzman ,  Adi Sharabani

    IPC分类号： G06F21/00

    CPC分类号： G06F21/52 ,  G06F21/55 ,  G06F2221/033

    摘要： A build process management system can acquire data pertaining to a software build process that is currently being executed by an automated software build system. The software build process can include executable process steps, metadata, and/or environmental parameter values. An executable process step can utilize a build artifact, representing an electronic document that supports the software build process. The acquired data can then be synthesized into an immutable baseline build process and associated baseline artifact library. The baseline artifact library can store copies of the build artifacts. The immutable baseline build process can include baseline objects that represent data values and dependencies indicated in the software build process. In response to a user-specified command, an operation can be performed upon the baseline build process and associated baseline artifact library.

    摘要翻译： 构建过程管理系统可以获取与当前由自动化软件构建系统执行的软件构建过程有关的数据。 软件构建过程可以包括可执行过程步骤，元数据和/或环境参数值。 可执行过程步骤可以利用构建工件，代表支持软件构建过程的电子文档。 然后，获取的数据可以被合成为不可变的基线构建过程和相关联的基线工件库。 基线工件库可以存储构建工件的副本。 不可变的基线构建过程可以包括表示软件构建过程中指示的数据值和依赖性的基线对象。 响应于用户指定的命令，可以在基线构建过程和相关联的基线工件库上执行操作。

    INJECTION CONTEXT BASED STATIC ANALYSIS OF COMPUTER SOFTWARE APPLICATIONS
    6.
    发明申请
    INJECTION CONTEXT BASED STATIC ANALYSIS OF COMPUTER SOFTWARE APPLICATIONS 有权
    基于注入上下文的计算机软件应用的静态分析

    公开(公告)号：US20110321016A1

    公开(公告)日：2011-12-29

    申请号：US12825293

    申请日：2010-06-28

    申请人： YINNON A. HAVIV ,  ROEE HAY ,  MARCO PISTOIA ,  ORY SEGAL ,  ADI SHARABANI ,  TAKAAKI TATEISHI ,  OMER TRIPP ,  OMRI WEISMAN

    发明人： YINNON A. HAVIV ,  ROEE HAY ,  MARCO PISTOIA ,  ORY SEGAL ,  ADI SHARABANI ,  TAKAAKI TATEISHI ,  OMER TRIPP ,  OMRI WEISMAN

    IPC分类号： G06F11/36 ,  G06F9/44

    CPC分类号： G06F11/3604 ,  G06F8/75 ,  G06F21/577

    摘要： Embodiments of the invention generally relate to injection context based static analysis of computer software applications. Embodiments of the invention may include selecting a sink within a computer software application, tracing a character output stream leading to the sink within the computer software application, determining an injection context of the character output stream at the sink, where the injection context is predefined in association with a state of the character output stream at the sink, identifying any actions that have been predefined in association with the identified injection context, and providing a report of the actions.

    摘要翻译： 本发明的实施例一般涉及计算机软件应用的基于注入上下文的静态分析。 本发明的实施例可以包括选择计算机软件应用程序内的汇点，跟踪通向计算机软件应用程序内的汇点的字符输出流，确定汇点处的字符输出流的注入上下文，其中注入上下文在 与汇点处的字符输出流的状态相关联，识别已经与所识别的注入上下文相关联地预定义的任何动作，以及提供动作的报告。

    Protection Against Cache Poisoning
    7.
    发明申请
    Protection Against Cache Poisoning 有权
    防止缓存中毒

    公开(公告)号：US20110066807A1

    公开(公告)日：2011-03-17

    申请号：US12559122

    申请日：2009-09-14

    申请人： Roee Hay ,  Adi Sharabani

    发明人： Roee Hay ,  Adi Sharabani

    IPC分类号： G06F12/08 ,  G06F12/00

    CPC分类号： H04L63/1441 ,  H04L29/08729 ,  H04L2463/145

    摘要： Protecting computers against cache poisoning, including a cache-entity table configured to maintain a plurality of associations between a plurality of data caches and a plurality of entities, where each of the caches is associated with a different one of the entities, and a cache manager configured to receive data that is associated with any of the entities and store the received data in any of the caches that the cache-entity table indicates is associated with the entity, and receive a data request that is associated with any of the entities and retrieve the requested data from any of the caches that the cache-entity table indicates is associated with the requesting entity, where any of the cache-entity table and cache manager are implemented in either of computer hardware and computer software embodied in a computer-readable medium.

    摘要翻译： 保护计算机免受高速缓存中毒，包括缓存实体表，其被配置为维持多个数据高速缓存与多个实体之间的多个关联，其中每个高速缓存与不同的一个实体相关联，以及高速缓存管理器 被配置为接收与任何实体相关联的数据并将接收到的数据存储在高速缓存实体表指示与该实体相关联的任何高速缓存中，并且接收与任何实体相关联的数据请求并且检索 来自缓存实体表指示的任何高速缓存的所请求的数据与请求实体相关联，其中缓存实体表和高速缓存管理器中的任一个被实现在体现在计算机可读介质中的计算机硬件和计算机软件 。

    Testing web applications for file upload vulnerabilities
    10.
    发明授权
    Testing web applications for file upload vulnerabilities 有权
    测试Web应用程序的文件上传漏洞

    公开(公告)号：US09009841B2

    公开(公告)日：2015-04-14

    申请号：US13435361

    申请日：2012-03-30

    申请人： Yair Amit ,  Roee Hay ,  Roi Saltzman

    发明人： Yair Amit ,  Roee Hay ,  Roi Saltzman

    IPC分类号： G06F21/00 ,  H04L29/06 ,  G06F21/57 ,  G06F21/60

    CPC分类号： H04L63/1433 ,  G06F21/577

    摘要： A system for detecting file upload vulnerabilities in web applications is provided. The system may include a black-box tester configured to upload, via a file upload interface exposed by a web application, a file together with a signature associated with the file. An execution monitor may be configured to receive information provided by instrumentation instructions within the web application during the execution of the web application. The execution monitor may be configured to recognize the signature of the uploaded file as indicating that the uploaded file was uploaded by the black-box tester. The execution monitor may also be configured to use any of the information to make at least one predefined determination assessing the vulnerability of the web application to a file upload exploit.

    摘要翻译： 提供了一种用于检测Web应用程序中的文件上传漏洞的系统。 该系统可以包括黑箱测试器，其被配置为经由web应用公开的文件上传界面，以及与文件相关联的签名一起上传文件。 执行监视器可以被配置为在web应用的执行期间接收由Web应用程序内的仪器指令提供的信息。 执行监视器可以被配置为识别上传的文件的签名，指示上传的文件是由黑匣子测试者上传的。 执行监视器还可以被配置为使用任何信息来做出至少一个预定义的确定来评估web应用的漏洞到文件上传漏洞。