利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

132 条记录 (耗时 0.027 秒)

    Generating a custom parameter rule based on a comparison of a run-time value to a request URL
    1.
    发明授权
    Generating a custom parameter rule based on a comparison of a run-time value to a request URL 有权
    根据运行时间值与请求URL的比较生成自定义参数规则

    公开(公告)号：US09026612B2

    公开(公告)日：2015-05-05

    申请号：US13447952

    申请日：2012-04-16

    申请人： Yair Amit ,  Roee Hay ,  Roi Saltzman ,  Omer Tripp

    发明人： Yair Amit ,  Roee Hay ,  Roi Saltzman ,  Omer Tripp

    IPC分类号： G06F13/00 ,  H04L29/08

    CPC分类号： G06F17/30893 ,  H04L29/08981

    摘要： Identifying at least one custom parameter in a request uniform resource locator (URL). The method can include identifying at least a first portion of source code of a Web application that typically consumes the custom parameter provided in the request URL and, via a processor, instrumenting the Web application at the first portion of the source code. The Web application can receive the request URL and the Web application can be executed with the instrumented source code. At least one run-time value consumed by the second portion of the source code can be identified, and the run-time value can be compared to the request URL to determine whether the run-time value intersects with the request URL. Responsive to determining that the run-time value intersects with the request URL, the run-time value can be identified as the custom parameter. A custom parameter rule can be generated based on the comparison.

    摘要翻译： 在请求统一资源定位符（URL）中标识至少一个自定义参数。 该方法可以包括识别Web应用程序的源代码的至少第一部分，其通常消耗在请求URL中提供的自定义参数，并且经由处理器在源代码的第一部分检验Web应用程序。 Web应用程序可以接收请求URL，Web应用程序可以使用带检测的源代码执行。 可以识别由源代码的第二部分消耗的至少一个运行时值，并且可以将运行时值与请求URL进行比较，以确定运行时值是否与请求URL相交。 响应于确定运行时值与请求URL相交，运行时值可以被标识为自定义参数。 可以根据比较生成自定义参数规则。

    Detection of custom parameters in a request URL
    2.
    发明授权
    Detection of custom parameters in a request URL 有权
    检测请求URL中的自定义参数

    公开(公告)号：US09087137B2

    公开(公告)日：2015-07-21

    申请号：US13334718

    申请日：2011-12-22

    申请人： Yair Amit ,  Roee Hay ,  Roi Saltzman ,  Omer Tripp

    发明人： Yair Amit ,  Roee Hay ,  Roi Saltzman ,  Omer Tripp

    IPC分类号： G06F15/173 ,  G06F17/30

    CPC分类号： G06F17/30893 ,  H04L29/08981

    摘要： Identifying at least one custom parameter in a request uniform resource locator (URL). At least a first portion of source code of a Web application that typically consumes the custom parameter provided in the request URL can be identified. The Web application can be instrumented at the first portion of the source code. The Web application can receive the request URL and the Web application can be executed with the instrumented source code. At least one run-time value consumed by the second portion of the source code can be identified, and the run-time value can be compared to the request URL to determine whether the run-time value intersects with the request URL. Responsive to determining that the run-time value intersects with the request URL, the run-time value can be identified as the custom parameter. A custom parameter rule can be generated based on the comparison.

    摘要翻译： 在请求统一资源定位符（URL）中标识至少一个自定义参数。 可以识别通常消耗请求URL中提供的自定义参数的Web应用的源代码的至少第一部分。 Web应用程序可以在源代码的第一部分进行检测。 Web应用程序可以接收请求URL，Web应用程序可以使用带检测的源代码执行。 可以识别由源代码的第二部分消耗的至少一个运行时值，并且可以将运行时值与请求URL进行比较，以确定运行时值是否与请求URL相交。 响应于确定运行时值与请求URL相交，运行时值可以被标识为自定义参数。 可以根据比较生成自定义参数规则。

    DETERMINING THE VULNERABILITY OF COMPUTER SOFTWARE APPLICATIONS TO ATTACKS
    3.
    发明申请
    DETERMINING THE VULNERABILITY OF COMPUTER SOFTWARE APPLICATIONS TO ATTACKS 有权
    确定计算机软件应用程序的易受攻击性

    公开(公告)号：US20110162072A1

    公开(公告)日：2011-06-30

    申请号：US12648445

    申请日：2009-12-29

    申请人： Roee Hay ,  Roi Saltzman ,  Adi Sharabani ,  Omer Tripp

    发明人： Roee Hay ,  Roi Saltzman ,  Adi Sharabani ,  Omer Tripp

    IPC分类号： G06F11/00

    CPC分类号： H04L63/1433 ,  G06F21/577 ,  H04L63/1483 ,  H04L67/02

    摘要： Determining the vulnerability of computer software applications to attacks by identifying a defense-related variable within a computer software application that is assigned results of a defense operation defending against a predefined type of attack, identifying a control-flow predicate dominating a security-sensitive operation within the application, identifying a data-flow dependent variable in the application that is data-flow dependent on the defense-related variable, determining whether the control-flow predicate uses the data-flow dependent variable to make a branching decision and whether a control-flow path leading to the security-sensitive operation is taken only if the data-flow dependent variable is compared against a value of a predefined type, determining that the security-sensitive operation is safe from the attack if both control-flow conditions are true, and determining that the application is safe from the attack if all security-sensitive operations in the application are determined to be safe from the attack.

    摘要翻译： 通过在计算机软件应用程序中识别防御相关变量来确定计算机软件应用程序对攻击的脆弱性，该计算机软件应用程序分配了针对预定类型攻击的防御操作结果，识别控制安全敏感操作的控制流谓词 该应用程序在应用程序中识别数据流依赖于与防御相关变量的数据流相关变量，确定控制流谓词是否使用数据流依赖变量进行分支决策，以及控制 - 只有当数据流相关变量与预定义类型的值进行比较时，才能获得导致安全敏感操作的流程路径，如果两个控制流条件都为真，则确定安全敏感操作对于攻击是安全的， 并且如果应用程序中的所有安全敏感操作都确定应用程序是否安全 被确定为安全的攻击。

    Determining the vulnerability of computer software applications to attacks
    4.
    发明授权
    Determining the vulnerability of computer software applications to attacks 有权
    确定计算机软件应用程序攻击的脆弱性

    公开(公告)号：US09210184B2

    公开(公告)日：2015-12-08

    申请号：US12648445

    申请日：2009-12-29

    申请人： Roee Hay ,  Roi Saltzman ,  Adi Sharabani ,  Omer Tripp

    发明人： Roee Hay ,  Roi Saltzman ,  Adi Sharabani ,  Omer Tripp

    IPC分类号： G06F11/00 ,  H04L29/06 ,  G06F21/57 ,  H04L29/08

    CPC分类号： H04L63/1433 ,  G06F21/577 ,  H04L63/1483 ,  H04L67/02

    摘要： Determining the vulnerability of computer software applications to attacks by identifying a defense-related variable within a computer software application that is assigned results of a defense operation defending against a predefined type of attack, identifying a control-flow predicate dominating a security-sensitive operation within the application, identifying a data-flow dependent variable in the application that is data-flow dependent on the defense-related variable, determining whether the control-flow predicate uses the data-flow dependent variable to make a branching decision and whether a control-flow path leading to the security-sensitive operation is taken only if the data-flow dependent variable is compared against a value of a predefined type, determining that the security-sensitive operation is safe from the attack if both control-flow conditions are true, and determining that the application is safe from the attack if all security-sensitive operations in the application are determined to be safe from the attack.

    摘要翻译： 通过在计算机软件应用程序中识别防御相关变量来确定计算机软件应用程序对攻击的脆弱性，该计算机软件应用程序分配了针对预定类型攻击的防御操作结果，识别控制安全敏感操作的控制流谓词 该应用程序在应用程序中识别数据流依赖于与防御相关变量的数据流相关变量，确定控制流谓词是否使用数据流依赖变量进行分支决策，以及控制 - 只有当数据流相关变量与预定义类型的值进行比较时，才能获得导致安全敏感操作的流程路径，如果两个控制流条件都为真，则确定安全敏感操作对于攻击是安全的， 并且如果应用程序中的所有安全敏感操作都确定应用程序是否安全 被确定为安全的攻击。

    System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies
    5.
    发明申请
    System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies 审中-公开
    用于同时定义和执行访问控制和完整性政策的系统，方法和装置

    公开(公告)号：US20150089637A1

    公开(公告)日：2015-03-26

    申请号：US14033502

    申请日：2013-09-22

    申请人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    发明人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    IPC分类号： G06F21/57

    CPC分类号： G06F21/57 ,  G06F21/51 ,  G06F21/604 ,  H04L63/102 ,  H04L63/20

    摘要： Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions.

    摘要翻译： 访问控制和信息流完整性策略在计算系统中通过检测在计算系统上运行的应用的软件代码中的安全敏感的汇和从计算系统可访问的数据库检索访问控制策略来实施。 访问控制策略将计算系统内的一组访问权限映射到多个主体中的每一个。 对于每个检测到的安全敏感接收器，检测到影响该安全敏感信宿的所有主体，并通过对该安全敏感信宿的所有影响主体的访问权限集合的交集来分配每个安全敏感信宿的总访问权限 水槽。 如果此权限集不足，则会报告完整性违规。 此外，权限标签分配给在安全敏感的接收器中使用的变量的每个值。 每个权限标签都是一组权限。

    Eliminating false reports of security vulnerabilities when testing computer software
    6.
    发明授权
    Eliminating false reports of security vulnerabilities when testing computer software 失效
    在测试计算机软件时，消除安全漏洞的虚假报告

    公开(公告)号：US08584246B2

    公开(公告)日：2013-11-12

    申请号：US12578013

    申请日：2009-10-13

    申请人： Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Takaaki Tateishi ,  Omer Tripp ,  Omri Weisman

    发明人： Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Takaaki Tateishi ,  Omer Tripp ,  Omri Weisman

    IPC分类号： G06F12/14

    CPC分类号： G06F21/57 ,  G06F11/3692

    摘要： A system for eliminating false reports of security vulnerabilities when testing computer software, including a taint analysis engine configured to identify a tainted variable v in a computer application, a data mapping identification engine configured to identify a variable x within the application that holds data derived from v, where x is in a different format than v, an AddData identification engine configured to identify an AddData operation within the application that is performed on x, a signature identification engine configured to identify a Sign operation within the application that is performed on the results of the AddData operation on x, a signature comparison identification engine configured to identify an operation within the application that compares the results of the Sign operation with another value.

    摘要翻译： 一种用于在测试计算机软件时消除安全漏洞的虚假报告的系统，包括配置成识别计算机应用程序中的受污染变量v的污染分析引擎，配置为识别应用程序内的变量x，该变量x保存从 v，其中x与v不同的格式，被配置为识别在x上执行的应用程序内的AddData操作的AddData识别引擎，被配置为识别在结果上执行的应用程序内的签名操作的签名识别引擎 的签名比较识别引擎，所述签名比较识别引擎被配置为识别应用程序内将所述Sign操作的结果与另一值进行比较的操作。

    System, method and apparatus for simultaneous definition and enforcement of access-control and integrity policies
    7.
    发明授权
    System, method and apparatus for simultaneous definition and enforcement of access-control and integrity policies 失效
    用于同时定义和执行访问控制和完整性策略的系统，方法和装置

    公开(公告)号：US08572727B2

    公开(公告)日：2013-10-29

    申请号：US12624172

    申请日：2009-11-23

    申请人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    发明人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    IPC分类号： G06F21/00

    CPC分类号： G06F21/57 ,  G06F21/51 ,  G06F21/604 ,  H04L63/102 ,  H04L63/20

    摘要： Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions.

    摘要翻译： 访问控制和信息流完整性策略在计算系统中通过检测在计算系统上运行的应用的软件代码中的安全敏感的汇和从计算系统可访问的数据库检索访问控制策略来实施。 访问控制策略将计算系统内的一组访问权限映射到多个主体中的每一个。 对于每个检测到的安全敏感接收器，检测到影响该安全敏感信宿的所有主体，并通过对该安全敏感信宿的所有影响主体的访问权限集合的交集来分配每个安全敏感信宿的总访问权限 水槽。 如果此权限集不足，则会报告完整性违规。 此外，权限标签分配给在安全敏感的接收器中使用的变量的每个值。 每个权限标签都是一组权限。

    System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies
    10.
    发明申请
    System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies 失效
    用于同时定义和执行访问控制和完整性政策的系统，方法和装置

    公开(公告)号：US20110126282A1

    公开(公告)日：2011-05-26

    申请号：US12624172

    申请日：2009-11-23

    申请人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    发明人： Paolina Centonze ,  Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Omer Tripp

    IPC分类号： G06F21/00 ,  G06F17/30

    CPC分类号： G06F21/57 ,  G06F21/51 ,  G06F21/604 ,  H04L63/102 ,  H04L63/20

    摘要： Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions.

    摘要翻译： 访问控制和信息流完整性策略在计算系统中通过检测在计算系统上运行的应用的软件代码中的安全敏感的汇和从计算系统可访问的数据库检索访问控制策略来实施。 访问控制策略将计算系统内的一组访问权限映射到多个主体中的每一个。 对于每个检测到的安全敏感接收器，检测到影响该安全敏感信宿的所有主体，并通过对该安全敏感信宿的所有影响主体的访问权限集合的交集来分配每个安全敏感信宿的总访问权限 水槽。 如果此权限集不足，则会报告完整性违规。 此外，权限标签分配给在安全敏感的接收器中使用的变量的每个值。 每个权限标签都是一组权限。